Scaling Trust: An Anthropology of Cyber Security (Renewal)

scale Trust是一个跨学科的研究项目，它利用了人类学、社会学、传播学、文论、科学哲学和计算机等学科的资源。通过访谈、文本分析、研讨会和民族志，《扩展信任》研究了网络安全在四个不同领域的最新转变，并提出了以下问题：在当代社会，新的模型和方法如何重塑信任和安全？新的威胁叙事形式、技术和规模问题以及安全解决方案如何定义安全的未来？A)在奖学金的最初阶段，我们调查了技术保证方面的当前转变。该领域中的安全性被视为技术产品的质量，可以在评估实验室中进行测试和测量的质量。近年来，我们可以观察到越来越多的人意识到依赖可信产品的意外副作用，以及关注风险和沟通质量的新方法的兴起。B)在最初的研究期间，我们还研究了“去周界化”安全模型的出现，今天最突出的是与“零信任”IT架构相关。我们一般检查安全模型的性质，以及这个模型如何特别挑战了信息安全的直觉，作为保护私有网络的“内部”，并将注意力集中在资产价值上。保护对象的这种表述对于什么是安全技术以及如何定位和对待用户/人具有深远的含义。C)在更新期间，我们将对“DevSecOps”运动进行实证研究，这是一项旨在重新配置组织的运动，以便将安全理解为组织的一项功能，不再处于“孤岛”中，而是集成在协作的多功能交付团队中。这里对社会架构的关注借鉴了软件开发中的经典组织思维，如Conway定律（技术倾向于从开发它的团队的结构中继承组织模式）、“设计安全”概念，并受到持续交付方法需求的驱动。安全在这里被理解为组织的一部分，除了开发、维护和运营之外。D)在更新期间，我们还对最近出现的基于硬件的漏洞（如Rowhammer， SPECTRE和Meltdown）进行了研究，这些漏洞从根本上挑战了建立安全推理的一些确定性。这些漏洞引起了人们对作为不确定性来源的硬件级别的关注，挑战了可以通过分析软件中实现的逻辑来理解安全性的概念。因此，除了防止攻击之外，安全还涉及到对新出现的漏洞做出响应。在扩展信任中，我们研究了安全的叙述，如何以不同但交叉的方式将安全构成为有意义的活动，因为这些专家领域正在经历转型：安全如何以不同的方式构成a)评估，B)架构，C)组织和D)功能的问题。正如我们所说，如果网络安全的本质不是固定的，而是通过一些专家的实践折射出来的，那么检查和理解它是如何变化的，以及对社会、组织和政策制定者的影响是很重要的。扩大信任包括与政策制定者和组织的参与活动组合。它涉及到使用定性研究方法的调色板，而且还开发了一种新的参与性研讨会形式，称为组织和研究人员的“信任映射”。这是一个奖学金项目，因此也涉及到对PI马特·斯宾塞博士的投资，支持他的职业发展轨迹和在网络安全研究领域的领导地位。

Scaling Trust is an interdisciplinary research project drawing on resources from anthropology, sociology, communication studies, literary theory, philosophy of science and computing. Using interviews, textual analysis, workshops and ethnography, Scaling Trust examines recent transformations in Cyber Security across four distinct domains, and asks: how are novel models and methods reshaping trust and securing in contemporary society? How do new forms of narrativizing threats, problems of technology and scale, and security solutions define what a secure future may be?A) In the initial period of the fellowship, we investigated current transformations in technology assurance. Security in this domain has been treated as a quality of technical products, a quality that can be tested and measured in an evaluation lab. In recent years, we can observe increasing awareness of unintended side effects of reliance on trusted products and the rise of new approaches focused on risk and the quality of communication.B) We also, in the initial fellowship period, examined the emergence of 'de-perimeterised' security models, today most prominently associated with 'Zero Trust' IT architectures. We examine the nature of security models in general, and how this one in particular has challenged intuitions of information security as the protection of an 'inside' of a private network, and focussed attention instead on asset value. This formulation of the object of securing has profound implications for what counts as a security technology, and for how users/people are positioned and treated. C) In the renewal period, we will conduct an empirical study of the 'DevSecOps' movement, a movement that aims to reconfigure organisations, so that security, here understood as an organisational function, is no longer in a 'silo', but becomes integrated in collaborative multi-function delivery teams. The focus on social architecture here draws on classic organisational thinking in software development, such as Conway's law (that technology tends to inherit a pattern of organisation from the structure of teams who made it), on 'Secure by Design' concepts, and is driven by the demands of continuous delivery methodologies. Securing is here understood as what a part of an organisation does, alongside developing, maintaining and operating.D) During the renewal period, we also build out a study of the recent emergence of hardware-based vulnerabilities, such as Rowhammer, SPECTRE and Meltdown, which have fundamentally challenged some of the certainties upon which security reasoning was built. These vulnerabilities drew attention to the level of hardware as a source of uncertainty, challenging the notion that security can be understood via analysis of logics implemented in software. In addition to preventing attacks, securing thus becomes a matter of being responsive to novel vulnerabilities as they emerge. In Scaling Trust, we examine the narrativization of security, how securing is constituted as a meaningful activity in distinct, but intersecting ways, as these expert domains undergo transformation: how security is variously posed as a problem of A) evaluation, B) architecture, C) organisation and D) function. If, as we argue, the nature of cyber security is not fixed, but rather refracts through a number of expert practices, it is important to examine and make sense of how it is changing and the implications for society, for organisations and for policymakers.Scaling Trust includes a portfolio of engagement activities with policymakers and with organisations. It involves the use of a palette of qualitative research methodologies, but also the development of a new participatory workshop format, called 'Trust Mapping' for organisations and researchers. It is a fellowship project, and thus also involves investment in the PI, Dr Matt Spencer, supporting his career trajectory and development of a position of research leadership in cyber security.